A Chinese-speaking threat actor has been observed using the DeepSeek artificial intelligence model in conjunction with the open-source Hermes Agent to conduct autonomous cyberattacks against internet-exposed servers. This activity, attributed to an individual operating under the aliases "knaithe" and "KnYuan," was uncovered by researchers at Palo Alto Networks' Unit 42.
The discovery was made after the Hermes Agent inadvertently created a web server from its home directory, exposing the attacker's operational environment. This exposed data included API keys, exploit scripts, target lists, shell history, and logs detailing the AI-driven attacks. While the autonomous attacks observed by Unit 42 did not result in successful compromises of the targeted systems, the campaign demonstrates a functional, end-to-end autonomous offensive capability.
The threat actor utilized DeepSeek as the reasoning engine for the Hermes Agent, an AI framework designed to interact with operating system terminals, execute commands, and connect to the internet. The agent was configured with a "Yolo" mode, allowing it to operate and execute commands, including potentially risky ones, without requiring prior operator permission. Instructions were provided via a Telegram channel, and the agent integrated custom offensive-security skills with the FOFA internet asset search engine.
In a session from May 2026, the operator reportedly provided only an initial task, after which the agent proceeded autonomously. The agent initially targeted Langflow servers vulnerable to CVE-2026-33017. It downloaded a public proof-of-concept exploit, identified 84 exposed instances via FOFA, and scanned them for vulnerable configurations. After determining these targets were not exploitable, the agent searched for other vulnerabilities.
DeepSeek then analyzed multiple public exploit repositories before selecting the n8n workflow automation platform as a new target, identifying over 647,000 exposed instances through FOFA. The agent downloaded an exploit chaining CVE-2026-21858 and CVE-2025-68613, identified servers running vulnerable versions, and checked for unauthenticated file-upload forms necessary for the attack. However, the discovered forms required authentication, leading to the autonomous attempts failing to compromise any targets.
Unit 42 highlighted the significance of this campaign, noting that the AI agent independently researched vulnerabilities, determined optimal targets, downloaded exploit code, and attempted exploitation within minutes—a process that would typically take many hours of manual effort. This autonomous process of target identification, sampling, and scope narrowing executed hundreds of hours of manual analysis in mere minutes, while also managing its own compute resources.
Beyond the AI-driven attacks, the threat actor also conducted manual attacks against over 460 systems. These manual efforts targeted vulnerabilities affecting Citrix NetScaler, Apache Tomcat, Marimo Notebook, and Windows IKE VPN, among other products. Unit 42 confirmed three successful compromises targeting the Citrix NetScaler vulnerability CVE-2026-3055, where the actor extracted memory and searched for authentication cookies to hijack sessions. While other AI coding platforms like Qwen, GLM, Kimi, MiniMax, Claude Code, and OpenAI's Codex were configured, they were not frequently used.
This exposed AI campaign follows a previous incident involving poorly secured Hermes infrastructure, which revealed details about an alleged cyberattack against Thailand's Ministry of Finance. In that earlier event, open web directories containing exploit tools, web shells, credentials, compiled payloads, and Hermes activity logs were discovered. Those logs showed Hermes operating in "YOLO" mode to automate post-exploitation activities, including searching for privilege escalation opportunities, enumerating services, inspecting containers, traversing filesystems, and cataloging documents on Ministry of Finance systems. However, the earlier incident did not demonstrate Hermes independently selecting targets or determining compromise methods; a human operator supplied the target, objectives, and attack tools, with Hermes automating routine activities after initial access was apparently obtained.
